Skip to content

Commit aa9f82b

Browse files
abrennan89abrennan89
authored
Merge pull request #50404 from abrennan89/SRVKS-951
SRVKS-951: Add internal TLS enablement docs
2 parents f6471be + 60561aa commit aa9f82b

9 files changed

+169
-4
lines changed

‎_topic_maps/_topic_map.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3624,6 +3624,8 @@ Topics:
36243624
- Name: Security
36253625
Dir: security
36263626
Topics:
3627+
- Name: Configuring TLS authentication
3628+
File: serverless-config-tls
36273629
- Name: Configuring JSON Web Token authentication for Knative services
36283630
File: serverless-ossm-with-kourier-jwt
36293631
- Name: Configuring a custom domain for a Knative service

‎_topic_maps/_topic_map_osd.yml

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -166,14 +166,14 @@ Topics:
166166
- Name: Upgrading OpenShift Dedicated
167167
File: osd-upgrades
168168
Distros: openshift-dedicated
169-
---
169+
---
170170
Name: CI/CD
171171
Dir: cicd
172172
Distros: openshift-dedicated
173173
Topics:
174174
- Name: Builds
175175
Dir: builds
176-
Distros: openshift-dedicated
176+
Distros: openshift-dedicated
177177
Topics:
178178
- Name: Setting up additional trusted certificate authorities for builds
179179
File: setting-up-trusted-ca
@@ -355,6 +355,8 @@ Topics:
355355
- Name: Security
356356
Dir: security
357357
Topics:
358+
- Name: Configuring TLS authentication
359+
File: serverless-config-tls
358360
- Name: Configuring JSON Web Token authentication for Knative services
359361
File: serverless-ossm-with-kourier-jwt
360362
- Name: Configuring a custom domain for a Knative service

‎_topic_maps/_topic_map_rosa.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -554,6 +554,8 @@ Topics:
554554
- Name: Security
555555
Dir: security
556556
Topics:
557+
- Name: Configuring TLS authentication
558+
File: serverless-config-tls
557559
- Name: Configuring JSON Web Token authentication for Knative services
558560
File: serverless-ossm-with-kourier-jwt
559561
- Name: Configuring a custom domain for a Knative service

‎modules/serverless-domain-mapping-custom-tls-cert.adoc

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
// Module included in the following assemblies:
22
//
3-
// * serverless/security/serverless-custom-domains.adoc
3+
// * /serverless/security/serverless-custom-domains.adoc
4+
// * /serverless/security/serverless-config-tls.adoc
45

56
:_content-type: PROCEDURE
67
[id="serverless-domain-mapping-custom-tls-cert_{context}"]

‎modules/serverless-enabling-tls-internal-traffic.adoc

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * /serverless/security/serverless-config-tls.adoc
4+
5+
:_content-type: PROCEDURE
6+
[id="serverless-enabling-tls-internal-traffic_{context}"]
7+
= Enabling TLS authentication for internal traffic
8+
9+
{ServerlessProductName} supports TLS edge termination by default, so that HTTPS traffic from end users is encrypted. However, internal traffic behind the OpenShift route is forwarded to applications by using plain data. By enabling TLS for internal traffic, the traffic sent between components is encrypted, which makes this traffic more secure.
10+
11+
[NOTE]
12+
====
13+
If you want to enable internal TLS with a {SMProductName} integration, you must enable {SMProductShortName} with mTLS instead of the internal encryption explained in the following procedure.
14+
====
15+
16+
:FeatureName: Internal TLS encryption support
17+
include::snippets/technology-preview.adoc[]
18+
19+
.Prerequisites
20+
21+
* You have installed the {ServerlessOperatorName} and Knative Serving.
22+
* You have installed the OpenShift (`oc`) CLI.
23+
24+
.Procedure
25+
26+
. Create a Knative service that includes the `internal-encryption: "true"` field in the spec:
27+
+
28+
[source,yaml]
29+
----
30+
...
31+
spec:
32+
config:
33+
network:
34+
internal-encryption: "true"
35+
...
36+
----
37+
38+
. Restart the activator pods in the `knative-serving` namespace to load the certificates:
39+
+
40+
[source,terminal]
41+
----
42+
$ oc delete pod -n knative-serving --selector app=activator
43+
----

‎modules/serverless-enabling-tls-local-services.adoc

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * /serverless/security/serverless-config-tls.adoc
4+
5+
:_content-type: PROCEDURE
6+
[id="serverless-enabling-tls-local-services_{context}"]
7+
= Enabling TLS authentication for cluster local services
8+
9+
For cluster local services, the Kourier local gateway `kourier-internal` is used. If you want to use TLS traffic against the Kourier local gateway, you must configure your own server certificates in the local gateway.
10+
11+
.Prerequisites
12+
13+
* You have installed the {ServerlessOperatorName} and Knative Serving.
14+
* You have administrator permissions.
15+
* You have installed the OpenShift (`oc`) CLI.
16+
17+
.Procedure
18+
19+
. Deploy server certificates in the `knative-serving-ingress` namespace:
20+
+
21+
[source,terminal]
22+
----
23+
$ export san="knative"
24+
----
25+
+
26+
[NOTE]
27+
====
28+
Subject Alternative Name (SAN) validation is required so that these certificates can serve the request to `<app_name>.<namespace>.svc.cluster.local`.
29+
====
30+
31+
. Generate a root key and certificate:
32+
+
33+
[source,terminal]
34+
----
35+
$ openssl req -x509 -sha256 -nodes -days 365 -newkey rsa:2048 \
36+
-subj '/O=Example/CN=Example' \
37+
-keyout ca.key \
38+
-out ca.crt
39+
----
40+
41+
. Generate a server key that uses SAN validation:
42+
+
43+
[source,terminal]
44+
----
45+
$ openssl req -out tls.csr -newkey rsa:2048 -nodes -keyout tls.key \
46+
-subj "/CN=Example/O=Example" \
47+
-addext "subjectAltName = DNS:$san"
48+
----
49+
50+
. Create server certificates:
51+
+
52+
[source,terminal]
53+
----
54+
$ openssl x509 -req -extfile <(printf "subjectAltName=DNS:$san") \
55+
-days 365 -in tls.csr \
56+
-CA ca.crt -CAkey ca.key -CAcreateserial -out tls.crt
57+
----
58+
59+
. Configure a secret for the Kourier local gateway:
60+
.. Deploy a secret in `knative-serving-ingress` namespace from the certificates created by the previous steps:
61+
+
62+
[source,terminal]
63+
----
64+
$ oc create -n knative-serving-ingress secret tls server-certs \
65+
--key=tls.key \
66+
--cert=tls.crt --dry-run=client -o yaml | oc apply -f -
67+
----
68+
69+
.. Update the `KnativeServing` custom resource (CR) spec to use the secret that was created by the Kourier gateway:
70+
+
71+
.Example KnativeServing CR
72+
[source,yaml]
73+
----
74+
...
75+
spec:
76+
config:
77+
kourier:
78+
cluster-cert-secret: server-certs
79+
...
80+
----
81+
82+
The Kourier controller sets the certificate without restarting the service, so that you do not need to restart the pod.
83+
84+
You can access the Kourier internal service with TLS through port `443` by mounting and using the `ca.crt` from the client.

‎modules/serverless-kafka-broker-tls-default-config.adoc

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
// Module is included in the following assemblies:
22
//
33
// * serverless/admin_guide/serverless-kafka-admin.adoc
4+
// * /serverless/security/serverless-config-tls.adoc
45

56
:_content-type: PROCEDURE
67
[id="serverless-kafka-broker-tls-default-config_{context}"]

‎modules/serverless-kafka-tls-channels.adoc

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
// Module included in the following assemblies:
22
//
3-
// * serverless/admin_guide/serverless-kafka-admin.adoc
3+
// * /serverless/admin_guide/serverless-kafka-admin.adoc
4+
// * /serverless/security/serverless-config-tls.adoc
45

56
:_content-type: PROCEDURE
67
[id="serverless-kafka-tls-channels_{context}"]

‎serverless/security/serverless-config-tls.adoc

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
:_content-type: ASSEMBLY
2+
[id="serverless-config-tls"]
3+
= Configuring TLS authentication
4+
include::_attributes/common-attributes.adoc[]
5+
:context: serverless-config-tls
6+
7+
toc::[]
8+
9+
You can use _Transport Layer Security_ (TLS) to encrypt Knative traffic and for authentication.
10+
11+
TLS is the only supported method of traffic encryption for Knative Kafka. Red Hat recommends using both SASL and TLS together for Knative Kafka resources.
12+
13+
[NOTE]
14+
====
15+
If you want to enable internal TLS with a {SMProductName} integration, you must enable {SMProductShortName} with mTLS instead of the internal encryption explained in the following procedure. See the documentation for xref:../../serverless/admin_guide/serverless-ossm-setup.adoc#serverless-ossm-enabling-serving-metrics_serverless-ossm-setup[Enabling Knative Serving metrics when using Service Mesh with mTLS].
16+
====
17+
18+
include::modules/serverless-enabling-tls-internal-traffic.adoc[leveloffset=+1]
19+
include::modules/serverless-enabling-tls-local-services.adoc[leveloffset=+1]
20+
21+
[role="_additional-resources"]
22+
.Additional resources
23+
* xref:../../serverless/admin_guide/serverless-ossm-setup.adoc#serverless-ossm-enabling-serving-metrics_serverless-ossm-setup[Enabling Knative Serving metrics when using Service Mesh with mTLS]
24+
25+
include::modules/serverless-domain-mapping-custom-tls-cert.adoc[leveloffset=+1]
26+
27+
// TLS for kafka
28+
include::modules/serverless-kafka-broker-tls-default-config.adoc[leveloffset=+1]
29+
include::modules/serverless-kafka-tls-channels.adoc[leveloffset=+1]

0 commit comments

Comments
 (0)